Barrendero

Solution to Wireshark Lab: Ethernet and ARP

Fig. 1 GET request Ethernet information
1. What is the 48-bit Ethernet address of your computer?
The Ethernet address of my computer is 00:09:5b:61:8e:6d
2. What is the 48-bit destination address in the Ethernet frame? Is this the Ethernet
address of gaia.cs.umass.edu? (Hint: the answer is no). What device has this as its
Ethernet address?[Note: this is an important question, and one that students
sometimes get wrong. Re-read pages 468–469 in the text and make sure you
understand the answer here.]

The destination address 00:0c:41:45:90:a8 is not the Ethernet address of
gaia.cs.umass.edu. It is the address of my Linksys router, which is the link
used to get off the subnet.
3. Give the hexadecimal value for the two-byte Frametype field. What do the bit(s)
whose value is 1 mean within the flag field?
The hex value for the Frame type field is 0x0800.
4. How many bytes from the very start of the Ethernet frame does the ASCII “G” in
“GET” appear in the Ethernet frame?
The ASCII “G” appears 52 bytes from the start of the ethernet frame. There
are 14 B Ethernet frame, and then 20 bytes of IP header followed by 20 bytesof TCP header before the HTTP data is encountered.
5. What is the hexadecimal value of the CRC field in this Ethernet frame?
The hex value for the CRC field is 0x 0d0a 0d0a.

Fig. 2 OK response Ethernet information
6. What is the value of the Ethernet source address? Is this the address of your
computer, or of gaia.cs.umass.edu (Hint: the answer is no). What device has this
as its Ethernetaddress?
The source address 00:0c:41:45:90:a8 is neither the Ethernet address of
gaia.cs.umass.edu nor the address of my computer. It is the address of my
Linksys router, which is the link used to get onto my subnet.
7. What is the destination address in the Ethernet frame? Is this the Ethernet address
of your computer?
The destination address 00:09:5b:61:8e:6d is the address of computer.8. Give the hexadecimal value for the two-byte Frame type field. What do the bit(s)
whose value is 1 mean within the flag field?

The hex value for the Frame type field is 0x0800.
9. How many bytes from the very start of the Ethernet frame does the ASCII “O” in
“OK” (i.e., the HTTP response code) appear in the Ethernet frame?
The ASCII “O” appears 52 bytes from the start of the ethernetframe. Again,
there are 14 bytes of Ethernet frame, and then 20 bytes of IP header followed
by 20 bytes of TCP header before the HTTP data is encountered.
10. What is the hexadecimal value of the CRC field in this Ethernet frame?
The hex value for the CRC field is 0x 0d0a 0d0a.

Fig. 3 Command prompt after executing arp
11. Write down the contents of your computer’s ARP cache. What is themeaning of
each column value?
The Internet Address column contains the IP address, the Physical Address
column contains the MAC address, and the type indicates the protocol type.

Fig. 4 ARP request message
12. What are the hexadecimal values for the source and destination addresses in the
Ethernet frame containing the ARP request message?
The hex value for the source address is00:d0:59:a9:3d:68. The hex value for
the destination address is ff:ff:ff:ff:ff:ff, the broadcast address.
13. Give the hexadecimal value for the two-byte Ethernet Frame type field. What do
the bit(s) whose value is 1 mean within the flag field?
The hex value for the Ethernet Fram type field is 0x0806, for ARP.

14. Download the ARP specification from ftp://ftp.rfc-editor.org/innotes/std/std37.txt. Areadable, detailed discussion of ARP is also at
http://www.erg.abdn.ac.uk/users/gorry/course/inet-pages/arp.html.
a) How many bytes from the very beginning of the Ethernet frame does the
ARP opcode field begin?
The ARP opcode field begins 20 bytes from the very beginning of the Ethernet
frame.
b) What is the value of the opcode field within the ARP-payload part of the
Ethernet frame in which...